Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

If you are using an older internet browser, new security restrictions mean that from Thursday, 7 June 2018, you may no longer be able to access our website. You will need to update your browser or use an alternative one. We apologise for the inconvenience but some older browsers are no longer secure enough for use on our website. Find out more here.

Privacy law reform is urgently needed to prevent New Zealand falling further behind international standards, says Privacy Commissioner John Edwards in his Briefing to the Incoming Minister of Justice released today.

Mr Edwards says most existing privacy laws around the world have been reformed in the last three years or are currently being reviewed and updated.

Internationally, the most influential is the European Union (EU) General Data Protection Regulation (GDPR) that comes into force in May 2018 and affects Europe and many of New Zealand’s trading partners. The GDPR standards lift the baseline internationally in response to the challenges to consumers and data protection in the global digital economy.

In 2011, the New Zealand Law Commission’s comprehensive review of privacy made numerous recommendations for changes to the Privacy Act. These proposed changes were to enable the law to better keep pace with the rapid changes over the past 20 years to information and communications technology. The Government at the time accepted the majority of those recommendations.

Mr Edwards noted a new Privacy Bill was currently being drafted. His office has been closely engaged with officials throughout this process. The key changes in the draft legislation included:

modernising the Privacy Act;

empowering the Privacy Commissioner to issue a compliance notice in the event of a breach of the Act;

empowering the Privacy Commissioner to issue a determination when a person has requested access to personal information under principle 6 and has been refused; and

the introduction of mandatory reporting of serious data breaches, to bring New Zealand into line with international best practice.

In a subsequent review of the operation of the Privacy Act in 2016, the Privacy Commissioner provided a report to the previous Minister of Justice, recommending additional reforms, including the power to fine non-compliant agencies.

Mr Edwards says New Zealand has a competitive trade advantage because the EU has formally recognised that our privacy law meets current EU standards. This EU adequacy status allows the unrestricted transfer of European data for processing. “The current risk for New Zealand is that our Privacy Act has fallen behind international standards and the case for reforming it is clear and very evident.”

The Privacy Commissioner’s Briefing to the Incoming Minister of Justice is available here.